Affected Systems

Windows users accessing third-party.com, a domain widely used as a placeholder in developer documentation (W3C, Chromium, GitHub examples). Over 1,500 files across 1,700+ repositories reference this domain. Developers who copied example code containing third-party.com URLs may inadvertently trigger connections to the malicious site. Linux and macOS users are not targeted.

Exploitation Status

Active exploitation confirmed since at least June 2026. The domain currently serves a fake Cloudflare CAPTCHA page that delivers ClickFix attacks. The payload delivery infrastructure (elxxvvx[.]xyz) was offline at time of reporting but was active as of May 2, 2026, distributing a 134MB malicious archive containing draw.io.exe. No public PoC required—the attack is live on the domain.

Business Impact

Developers and organizations that copied documentation examples containing third-party.com into production code, test environments, or internal tools may now trigger connections to a malicious site. Users visiting the domain see a fake CAPTCHA that copies PowerShell commands to the clipboard and instructs execution via Windows+R. This ClickFix technique can bypass traditional antivirus by relying on user-executed commands rather than file downloads. The attack targets Windows systems exclusively. The domain has been referenced in trusted documentation from W3C, Chromium, and major open-source projects, increasing the risk of inadvertent exposure.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit internal codebases, configuration files, and test environments for references to third-party.com and replace with IANA-reserved domains (example.com, example.net, example.org) or internal test domains.
  • Block third-party.com at the network perimeter (firewall, DNS sinkhole, proxy) to prevent outbound connections from development, staging, and production environments.
  • Search endpoint logs and web proxy logs for connections to third-party.com and elxxvvx[.]xyz since June 2026 to identify potentially compromised systems.
  • Educate developers and end users about ClickFix attacks: never execute PowerShell commands from untrusted sources, especially those copied to the clipboard by websites.
  • Review and update internal secure coding guidelines to mandate use of IANA-reserved placeholder domains in all documentation and example code.